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We consider the class of reference frame independent protocols in d dimensions for 
quantum key distribution, in which Alice and Bob have one natural basis that is aligned 
and the rest of their measurement bases are unaligned. We relate existing approaches to 
tomographically complete protocols. We comment on two different approaches to finite 
key bounds in this setting, one direct and one using the entropic uncertainty relation 
and suggest that the existing finite key bounds can still be improved. 
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1. Introduction 

QKD protocols such as BB8421, and six-state^, as they are defined in the literature, 
require the alignment of Alice and Bob's local measurement frames: Xa = Xb = X, 
Ya = Yb = Y and Za — Zb — Z where X, Y, Z stand for the Pauli operators 
ex > oy > <Jz- It has been known for some time that alignment can be dispensed 
with, if one is ready to change the physical implementation of the qubit l 6 ! 18 ! 1 ^ 
but these schemes require complex quantum states and are considered impractical. 
More recently, it was shown that reference frame independence can be achieved 
by changing the protocol, while keeping the same physical implementation. The 
main idea in the reference frame independent (rfi) protocol is that Alice and Bob 
share a common well-aligned measurement basis Z = Za = Zb (which is naturally 
available in many practical implementations]^]), while the other measurements can 
be misaligned by an arbitrary but fixed angle f3 

X B = cos PX A + sin /3Y A , Y B = cos pY A - sin f3X A - (1) 



a Consider for examples, the time basis in a time bin implementation, the circular polarization 
basis, or the basis of different paths. 
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Since the "natural basis" is automatically aligned, we have access to the quantum 
bit error rate in the Z basis, 

Q = Pr(error) = Pr(a^b) = 1 ~ ( Z ® Z ) _ ( 2 ) 

However, we also require additional information, namely the parameter C, in order 
to bound Eve's information. 

2. The parameter C 

The original rfi protocol introduced the /3-independent parameter C, 

C = (X A ® X B ) 2 + (X A ® Y B ) 2 + (Y A ® X B ) 2 + (Y A ® y B ) 2 , (3) 

which is an entanglement witness (C < 1 for separable states and C = 2 for 
maximally entangled states) to bound Eve's information. 

We note that the protocol can be generalized to qudits in the following manner. 
Denoting {|0) , |1) , \d — 1)} the computational basis vector of the Hilbert space 
describing a qudit, it is well known that the Pauli operators admit a generalization 
to higher dimension known as the Weyl operators, which are unitary operators of 
the form X k Z e for k,£ G {0, 1, d - 1} and 

d-l d-1 

Z = J2" j \3)(j\i * = + 1)01, (4) 

3=0 3=0 

where uj = e 2 ™/ d are the roots of unity and j + 1 denotes the sum modulo d. 
To accommodate relative unitary rotation around Z, let X A = UXU^ and Xg = 
VXV^ where [U, Z] = [V, Z] = 0. In the protocol, Alice and Bob perform the 
projective measurements on the eigenstates of X^ Z lt and X B 2 Z e2 and from the 
statistics estimate Q and 

C= \( X A Ztl ®X k B 2 Z l2 )\ 2 (5) 

fei ,fc 2 =i 

to bound Eve's information. In the appendix we prove that ([5| is a generalization 
of ([3| with all the desired properties: it is independent of the local unitaries U and 
V mentioned above and is an entanglement witness (C < (d — l) 2 for separable 
states and C = d(d— 1) for maximally entangled states). 

3. The tomographic approach 

The way measurement results are used in the rfi protocol and its generalized ver- 
sion is not optimal, in the sense that the tomographic information deducible from 
the measurement statistics can be used directly, instead of via the parameter C. 
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Estimating C requires the knowledge of [d(d - l)] 2 correlators (X^ 1 Z £l <g> X B 2 Z l2 ) 
which can alternatively also be used to completely specify the state as^ 

1 d-1 

PAB = & zZ ( X A zei ®X%Z l *)X k A l Z^ ®X h B 2 Z t2 (6) 

in the measur ement bases of Alice {X^Z 11 } and Bob {X^Z 11 }. However, working 
only from C discards some information that can lead to a tighter bound on Eve's 
information. Using tomography, one can have a rfi protocol without the need for 

Let us explain in detail how that is possible. The most direct approach is to 
make d 2 measurements X k Z e on each subsystem (Alice has one, Bob the other) and 
combine the measurement outcomes to find each correlator directly. This is very 
inefficient because it requires d 2 different estimates to be made with good precision, 
which requires many copies of the state. (Recall that collective attacks are the 
optimal attack in general for Eve in this scenario EEH) Also it is unnecessary because 
many of the Weyl operators have the same set of eigenvectors (Z l for I = 0, d — 1 
for instance); hence the measurement statistics of one can be used to calculate the 
average values of all the others. In general, the minimum number of measurements 
needed to completely specify the state is still unknown. However, if d is prime, 
one can reconstruct the state by making only d + 1 measurements corresponding 
to d + 1 mutually unbiased bases on each subsystem, say B = {Z, XZ l : I — 
0, ...,d — 1}. After the measurements, Alice and Bob can estimate their marginal 
probability distribution locally, and if they share the measurement outcomes, the 
joint probability distribution p(a, b\A (g) B) where A,BeB. It is well known that 
the eigenbasis of any X k Z £ is among the eigenbases of observables in B; therefore 
from p(a, b\A eg) B) we can compute all the average values using 

(X k /Z^ <g> X k B 2 Z l2 ) = z 2^X b p(a,b\A^B), (7) 

a ,6 

where A Q is the eigenvalue associated to the eigenvector representing outcome a of 
X^-Z^ 1 and A is the operator in B with the same eigenbasis as X^ , ditto for Bob. 
Hence a full state reconstruction is possible by (JsJ) . 

Once pab is found relative to the (partially) unaligned frames, it is possible to 
find local rotations Ua, Ub such that Ua <8> UbPabU\ ® U B = pab where pab is 
a diagonal matrix of the eigenvalues of pab- This procedure is always possible if 
Alice and Bob's marginals are random, and if this is not the case, Alice and Bob 
can do the randomization themselves. Then pab is a mixture of d-dimensional Bell 
states (maximally entangled states) in the new bases effected by the local rotations. 
Using the eigenvalues, A, of this state, the asymptotic rate will be^ 



r<» =logd-ff(A), 



(8) 
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and the finite key bounds can also be calculated from those methods to give, 



r N = ( min H(A\E) - leak EC /n - - log — - (21ogd + 3) W log(2/e) ) , 
xr 1 b|p±m n e PA V n J 

(9) 

where the security parameter is e = eEc+ e PA+^PEepE+e, and £ec is the probability 
of failure of the error correction step, epA the probability of failure of the privacy 
amplification, epe is the probability that the estimate of any measured parameter P 
is outside a tolerated range /i. The minimization of H(A\E) is done over all attacks 
of Eve, denoted by E, compatible with observed parameters P within tolerated 
fluctuations \x. 

We also note that doing tomography it is possible to relax the assumption of the 
"natural basis" , allowing Alice and Bob to have one axis which they know is close 
to being aligned but is not perfectly aligned. This will lead to an increase in the 
error rate Q. For example, for the case d = 2 the Z axes must not differ by more 
than 41.5° for Q to be small enough to have any hope of generating the shared 
randomness required to grow a secret key. However, it is a natural assumption in 
many settings to take one basis to be aligned. 



4. Bounds from Uncertainty Relations 

Recently, a tighter finite-key bound for the Bennett-Brassard 1984 (BB84) protocoP 
has been found by Tomamichel et. al. For some time there has been the idea of 
viewing the security of QKD as reducing to suitable URs. After a series of works 
HEM], this program was brought to completion by Tomamichel and Renner ^ who 
indeed provided a UR involving the quantity that captures Eve's uncertainty in 
QKD: the smooth min- entropy conditional on a quantum observer. The result is 
directly applicable to finite-key bounds^*!. 

We can also use this approach instead of the tomographic approach described 
above to obtain a security bound for the rfi protocols. That is possible by using the 
complete knowledge of the eigenvalues A to infer the max-entropy in the virtual 
bases corresponding to the local rotations that optimized Alice and Bob's correla- 
tions. 

The UR lower bounds Eve's uncertainty on the key, 

^ n (Z|£)+^ ax (X|B)>logi (10) 

where c quantifies the 'incompatibility' between the measurements Z = Z® n and 
X = X® n . Moreover, as any decent measure of uncertainty, H mayi can only increase 
under information processing and in particular under Bob's measurement ^1, so 

flLx(X|B) < flLx(X|X') (ii) 

where the measurement X' = X'® n is made on system B. Now comes the crucial 
insight for what follows: the protocol does not have to prescribe the actual mea- 
surement of X and X'. Given the observed parameters, we are free to imagine the 
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measurement X' on Bob's side that makes his uncertainty as small as possible on 
a hypothetical measurement X. The data required for this is easily found once the 
state is reconstructed from the tomographic data. 

Let X and X' be observables mutually unbiased to Z with outcomes in dimen- 
sion d corresponding to measurements on Alice and Bob respectively, whence the 



right hand side of (10) reduces to nlogd. Using a bound for -£/^ ax found using an 
extension of the method of 

HL^XIX') < nHi-vxvxM), (12) 

finally we have to maximize H (vxgiX'ilJ')), where Vx®x' (a0 is the vector of prob- 
abilities of the different outcomes (the parameters P) in this virtual basis, up to a 
finite sampling uncertainty fi. In this way, we have been conservative in giving Eve 
maximum information on the key, compatible with our observed data. The finite 
key rate reads therefore 

n f 2 1 \ 
nv < -rf logd - H(v x ®x> (p)) - leakEc/n- log —, . (13) 

We can maximize this value over the trade-off between the signals devoted to the 
key and those devoted to parameter estimation, as well as over the choices of epE 
and epA compatible with e soc for given eEC and now e is a function of epE- 




6 L. P. Thinh, L. Sheridan and V. Scarani 



5. Conclusions 

The derivation of the UR is generic: it is not linked to BB84, nor to QKD for that 
matter. Still, one may surmise that, in the context of QKD, such a UR is of prac- 
tical use only for two-measurement protocols like BB84 and its higher-dimensional 
generalizations HEH When it comes to the six-state protocol, which uses three mea- 
surements, the UR yields the same bound as for BB84, while a better bound is found 
by taking into account the detailed structure of the states^. In fact, in considering 
the rfi protocol, for which the bound described in the previous section with d = 2 
is equivalent to the bound for the six-state protocol, the asymptotic bound for the 
secret key is indeed worse using the UR technique. However, the critical number 
of signals at which the secret key rate becomes positive is reduced using the UR 
approach (see Figure [T]). This suggests that there should exist a better technique for 
constructing the finite-key bounds that gives the best of both methods, probably 
by eliminating the need for the smoothing correction term given in section 3.3.4 of 
Renner 's thesisP. 
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Appendix. 

The essential ingredients in the proof that equation ^ generalizes C are twofold: 
(i) the relation between average values of operators and the Hilbert-Schmidt inner 
product, namely (0) p = (p, O) where (•, •) is the Hilbert-Schmidt inner product de- 
fined as (A, B) = Tr(A^i3), and (ii) the Weyl operators as an orthonormal basis up 
to normalization, i.e. (X kl Z £l , X k2 Z l2 ) — d5k 1: k 2 $iiM- We recall the computation 
of inner product using an orthonormal basis 



To prove that C is invariant with respect to rotations around Z, first note that 
C can be rewritten as 



( P ,p) = \ J2 (p,x k z*)(x k z?, P ) = \ J2 \(p> xkz *)\ 2 - 



(14) 





c= \( x A zil ®x k B zl2 )\ 2 - \{z l1 ® X k B 2 Z l2 )\ 2 




d-1 



d-1 




(15) 
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where the first sum simplifies to d 2 Tr(p\ B ). We can switch bases from Xg 2 Z l2 
to X k ' 2 Z l2 since they are both bases for £(C d ), thus invariant, and similarly for 
the third sum. The final term is obviously invariant with respect to Z rotations. 
Therefore, we have proved that C is independent of the local unitaries U and V 
commuting with Z. 

To show that C acts as an entanglement witness, consider the product state 
Pab = &a® f° r which C factorizes into 

C=J2 \{X k A ztl )°A? E K*b^ 2 U| 2 (16) 
fcl=l fe 2 =l 
i 1= £2=0 



and note that 



E \( X A ztl )<TA\ 2 = dTr(o* A ) ~ 1 - E K^J 2 < d- 1, (17) 
fci=i £1=1 

<i=0 

from which C < (d— l) 2 for all product states and moreover for all separable states 
by convexity. Thus if C > (d—1) 2 for a particular state, then the state is entangled, 
however, the converse, that the state is separable for C less than that value, is not 
implied. Indeed entangled states can have C < (d — l) 2 . 

Note that C is a sum over tensor products of operators that do not commute 
with Z, the raw key basis. The maximum value of C is only achieved for maximally 
entangled states. The maximum value that can be obtained with a separable state is 
(d — 1) 2 , therefore there is a gap between separable states and maximally entangled 
states that scales linearly with d. 
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